I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still preventing me from running it. What am I missing to get this to work?

I disabled it by adding DisableAntiSpyware toHKLM/Software/Policies/Microsoft/Windows Defender and setting it to 1. enter image description here

  • How is it preventing it? What messages do you see? How do you know it's Windows? Have you looked at the Event Log? Mar 11 at 4:51
  • Well I initially thought it was windows blocking it, but it is an older sample I am looking at so it just might not work on Windows 8/10/11. I did try Windows 11 and on 11 even with everything off Windows 11 still removes it from the machine. I had to add it to allowed threats. But it does not move itself to another folder like it should. I have a feeling it might just not work correctly on newer OSes. Mar 11 at 13:07
  • I am going to try execute it using wine on my REMnux box. Mar 11 at 13:09
  • It is also not making any network requests like it should. Mar 11 at 13:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.